Privacy policy

Last updated 5 September 2026

Who we are

Tratto is operated by Sicilia Build S.r.l.s. Unipersonale, Via Angelo Cavarra 144, 96017 Noto (SR), Italy. For any question about this policy or your data, contact [email protected]. We are the data controller for the limited processing described below.

We are not the controller of what you enter into the app, because we never receive it. What you record is health data, and it stays on your device. We are the controller only for the limited things we do receive: emails you send us, and mailing-list addresses.

What Tratto stores, and where

Everything you enter into the app — your protocol, the steps and amounts you record, your symptom check-ins, your notes and any photos you add — is written to storage on your device and stays there. It is not transmitted to us. We cannot see it, retrieve it, or recover it for you if you delete it or lose the device.

Because this data never reaches us, we do not hold a copy of your health information. That is a deliberate design choice rather than a policy promise: there is no database for us to be careless with.

Health data

Symptom scores, bowel records and photographs are special category personal data under Article 9 of the UK and EU GDPR. Because this data is processed only on your device and never transmitted to us, we do not process it as a controller. Where any optional feature would change that, we will ask for your explicit consent first, separately, and explain exactly what would be sent and where it would be stored.

Optional features that involve other parties

• Cloud-assisted import. If we offer, and you explicitly enable, an enhanced import that sends the text of a document you paste to a processing service, we will tell you before it happens, process it in the European Union, and not retain the content afterwards. It is off by default.
• Health app integration. If you connect Apple Health or Health Connect, Tratto reads only the categories you approve, keeps that data on your device, and writes nothing back.
• Purchases. Payments are taken by Stripe on its hosted checkout page (or, while that is being connected, arranged by email); we never receive your card details. Stripe tells us that a purchase occurred and the email address you paid with, and the licence key is sent to that address by our email service, Resend. The key itself is checked on your phone and is never sent anywhere.

Analytics and tracking

The app contains no third-party analytics, no advertising identifiers and no tracking software. We do not build profiles, we do not run advertising, and we never sell or broker data — nor would we have anything to sell.

This website may use privacy-preserving, cookieless analytics that record page views without identifying you or storing cookies on your device. No account or app data is connected to it.

Your rights

Under the GDPR you have rights of access, rectification, erasure, restriction, portability and objection. Because your data sits on your device, most of these you exercise directly and instantly:

• Access and portability — More → Data → Export everything, which produces a complete file in an open format.
• Erasure — More → Data → Delete all my data. This is immediate and irreversible.
• Rectification — every entry in the app is editable, including past days.

For anything we do hold — a support email, a mailing list address, a purchase record — write to [email protected] and we will respond within 30 days. You also have the right to complain to your supervisory authority; in Italy that is the Garante per la protezione dei dati personali.

Retention

The email box on the site is handled by Web3Forms (a form-delivery service; its servers may be outside the EEA, and it holds the address only to deliver it to us). The address then sits in our mailbox. We do not pass it to anyone else.

App data is kept on your device until you delete it. Mailing list addresses are kept until you unsubscribe. Support correspondence is kept for up to two years. Purchase records are kept for ten years, as Italian tax law requires. Resend, which delivers the licence email, is based in the United States; the transfer rests on its standard contractual clauses and carries only the address you paid with and the key.

Children

Tratto is not intended for anyone under 16 and we do not knowingly collect data from children.

Changes

If this policy changes materially we will update the date above and, where the change affects how your data is handled, tell you in the app before it takes effect.